import { OutboundPolicy } from "../../security/outbound-policy.type.mjs";
import { SkillsStoreContract } from "../contracts/skills-store.contract.mjs";

//#region ../ai/src/skills/sources/url-source.d.ts
/** Options for {@link urlSource} (S3). */
type UrlSourceOptions = {
  headers?: Record<string, string>; /** Fetch hardening for the manifest request. */
  policy?: OutboundPolicy; /** Cache the manifest for this many ms; omit to cache for the source's lifetime. */
  cacheTtlMs?: number;
};
/**
 * Read skills from a remote JSON manifest at `url`. The manifest is a flat
 * array of {@link SkillRecord}s (bodies inline).
 *
 * **Trust boundary (S3).** A remote skill source is a prompt supply chain —
 * its bodies flow straight into model context — so the manifest fetch runs
 * through the shared `OutboundPolicy` (scheme + host allowlist, post-DNS
 * private-IP deny, max bytes, timeout) and **every record is runtime-
 * validated** before it can be served. A malformed record fails loudly
 * rather than being cast blindly into a `SkillRecord`.
 *
 * The request is made lazily on the first `list()` / `load()`. The result
 * is cached for the source's lifetime, or for `cacheTtlMs` when set
 * (a stale cache refetches on next access).
 */
declare function urlSource(url: string, options?: UrlSourceOptions): SkillsStoreContract;
//#endregion
export { urlSource };
//# sourceMappingURL=url-source.d.mts.map